Troubleshooting master server communication failures in the NetBackup Add-in for SCVMM
To recover VMs, the add-in must have a registered NetBackup master server with a valid and correct authentication token. The NetBackup administrator generates the authentication token on a specific NetBackup master server for a specific SCVMM console host. The token gives the SCVMM console host access to the NetBackup master server where the token was generated. (Note: you can validate authentication tokens for currently registered master servers by means of the option in the add-in.)
If the TCP/IP address or host name of the SCVMM console host does not exactly match the information in the authentication token, the following operations fail: the Manage Master Servers operation, and VM recovery. Error messages such as the following may appear:
Unable to connect the Netbackup Master Server. Do you want to add this master server?
Authentication failed. Please verify that the master server token is valid and correct using the 'Manage Master Servers' dialog box
To correctly determine the problem and the corrective action, you must review the VxUL log file. On the master server, enter the following command:
vxlogview -i nbwebservice -p nb - L -E
The log file includes messages similar to the following:
02/17/2017 10:03:37.831 [Error] Remote host name does not match the name in the certificate, remote name:scvmm02.domain.com, name from certificate:scvmm02
In the log snip shown, the name in the token is scvmm02 and the required name is scvmm02.domain.com.
Veritas recommends that you revoke the existing token, generate a new token with the required name, and use the new token on the SCVMM console host. If you cannot do that, add the SCVMM console host's fully qualified domain name as an alias for the existing token, as follows:
manageClientCerts -addAlias scvmm02 -HOST scvmm02.domain.com
As an alternative, you can use the -ANY option:
manageClientCerts -addAlias scvmm02 -ANY
-ANY allows any host or any IP address to communicate with the NetBackup server by means of this token.
Caution:
The -ANY option is not a secure method for restores. Please see the NetBackup Commands Reference Guide for more information on the manageClientCerts command.
The log file includes messages similar to the following:
02/17/2017 16:18:13.951 [Error] Remote host name does not match the name in the certificate, remote name:10.10.10.11, name from certificate:scvmm02
In the log snip shown, the name in the token is scvmm02 and the required name is 10.10.10.11.
Veritas recommends that you revoke the existing token, generate a new token with the required name, and use the new token on the SCVMM console host. If you cannot do that, add the SCVMM console host's TCP/IP address as an alias for the existing token, as follows:
manageClientCerts -addAlias scvmm02 -IP 10.10.10.11
As an alternative, you can use the -ANY option:
manageClientCerts -addAlias scvmm02 -ANY
-ANY allows any host or any IP address to communicate with the NetBackup server by means of this token.
Caution:
The -ANY option is not a secure method for restores.
Additional information is available:
See Adding or deleting an additional host name or IP address for an authentication token.
See the manageClientCerts command in the NetBackup Commands Reference Guide.